Instant DMARC Reports

DMARC aggregate reports arrive once a day. That single fact shapes every DMARC rollout: change a record, wait 24 hours, read the report, adjust, wait again. Protocol work that takes an afternoon stretches into weeks of calendar time, and many domains stall at p=none along the way.

We built an instant report inbox to remove the wait. It generates standard DMARC aggregate reports within minutes of a test email, each covering a one minute reporting window. It is free for anyone to use.

Why reports are daily in the first place

The original DMARC specification, RFC 7489, made daily aggregate reporting the default. It also defined an ri tag so a domain owner could request a shorter interval, and it said receivers should be able to provide hourly reports on request, on a best effort basis. In practice receivers ignored the tag and sent daily reports.

The new DMARC specification made this official. In May 2026 the IETF published DMARC as three Standards Track RFCs: RFC 9989 (core protocol), RFC 9990 (aggregate reporting), and RFC 9991 (failure reporting). RFC 9989 removes the ri tag. RFC 9990 describes aggregate feedback as daily or more frequent reports and notes that a reporting period typically covers a single UTC day starting at 00:00 UTC.

Nothing in the specification forbids faster feedback. "Daily or more frequent" leaves the door open. Receivers do not walk through it, and after the removal of ri there is no longer a mechanism to ask.

What the daily cycle costs you

A 24 hour reporting interval turns every small mistake into a full day of blindness:

• A broken SPF include sits unnoticed until tomorrow's reports arrive.

• A misaligned DKIM signature from a newly added SaaS sender surfaces a day after the first affected email.

• Each iteration of a fix needs another day before you can confirm it worked.

The protocol work is quick, the waiting is not. Slow feedback is one of the main reasons domains stay at p=none long after monitoring began.

How the instant DMARC report inbox works

The instant report inbox gives you a dedicated address at a receiving domain we operate. Send a test email to that address from any system that sends mail as your domain. Our receiver evaluates SPF, DKIM, and DMARC alignment exactly as a mailbox provider would and generates an aggregate report within minutes.

Each report covers a one minute reporting window. The date_range element holds a begin and end timestamp 60 seconds apart, in UTC. Test messages that arrive within the same minute are counted together in one report, a message in the next minute produces a new report. Reporting windows do not overlap.

The reports are ordinary aggregate reports in the RFC 9990 XML format (namespace urn:ietf:params:xml:ns:dmarc-2.0), with the same source IP, envelope from, header from, SPF result, DKIM domain and selector, and alignment results a mailbox provider would send. Your DMARC record is discovered with the DNS tree walk defined in RFC 9989, and the report says so in discovery_method. Anything that parses Gmail or Yahoo reports can parse ours. The difference is timing: minutes instead of a day.

Reports are delivered the same way any receiver delivers them: to the rua addresses in your DMARC record. If your rua points to DmarcDkim.com, the report appears in your DMARC dashboard within minutes. If it points to another provider, that provider receives the report by email, subject to the usual external destination check in RFC 9990.

A typical debugging session changes shape. Publish a record change, send a test email, read the report, adjust, send again. The full loop takes minutes, so an SPF flattening issue or a DKIM selector mixup that used to burn a week of daily iterations can be resolved in one sitting.

How to start

1. Sign up or log in to the DMARC dashboard at dmarcdkim.com.

2. Add your domain and verify ownership.

3. Make sure your domain has a _dmarc record with a rua address. Generate one at dmarcdkim.com/tools/how-to-generate-dmarc-record or check the existing DMARC record at dmarcdkim.com/dmarc-check.

4. Open the "Configure SPF and DKIM" step.

5. Add "My Email Source". This reveals your instant DMARC report address.

6. Send a test email to that address from the system you want to check.

7. Read the DMARC report in the dashboard about a minute later.

Getting a useful result

A few things make the difference between a clean test and a misleading one:

• Reports go where your DMARC record says. No rua, no report. If rua points to a third party, that party must publish the _report._dmarc authorisation record, as with any receiver.

• Send the test from the actual system you want to verify: your ESP, your Microsoft 365 or Google Workspace tenant, your ticketing tool. A message sent from a laptop through a different relay tells you nothing about the path in question.

• After you change an SPF, DKIM, or DMARC record, resolvers keep the old value until the TTL expires. A test sent too early might be evaluated against the old record. Lower the TTL before a rollout, or wait it out.

• A DKIM pass on a domain that is not your header from domain is not aligned. Compare header_from, envelope_from, and the DKIM value in the report against what you expect.

What it is and what it is not

The instant report inbox reports on email you send to it. It does not make Gmail, Yahoo, or Microsoft report faster on your general mail flow; their aggregate reports about all traffic to their users still arrive on their daily schedule.

That makes the instant inbox a debugging and verification tool, not a replacement for ongoing monitoring. Use it to test changes, onboard new sending services, and verify alignment before enforcement. Use aggregate reports from mailbox providers to watch your full sending landscape over time.

The two work together: instant reports to iterate quickly, daily reports to confirm the whole picture.

Free for everyone

Our goal is broader DMARC adoption. The biggest friction we see in rollouts is the feedback delay, so removing it should not sit behind a paywall. The instant report inbox is free of charge for anyone.

Check your domain at dmarcdkim.com/dmarc-check, then follow the steps above to send your first test email.

DMARC FAQ

Are instant reports in the same format as regular DMARC aggregate reports? Yes. They use the RFC 9990 aggregate report XML format with the dmarc-2.0 namespace, including SPF, DKIM, and alignment evaluation results, source IP, the DKIM selector, and the discovery_method used to find your record. Any tool or workflow that processes reports from mailbox providers can process instant reports the same way. The only difference is timing: a report is generated within minutes of your test email and its reporting window is one minute long instead of one day.

What happens if I send several test emails in a row? Messages that arrive within the same one minute window are aggregated into a single report, with separate rows per source IP and result combination. Messages in different minutes produce separate reports with non overlapping windows. If you want to compare two configurations, wait for the next minute between tests so each result lands in its own report.

Do instant reports replace aggregate reports from Gmail or Microsoft? No. Instant reports cover email you send to your instant inbox address, which makes them ideal for testing and debugging. Mailbox providers continue to send daily aggregate reports covering all mail they receive from your domain, and you should keep collecting those for ongoing monitoring. The instant inbox shortens your fix cycle; provider reports confirm your overall posture.

Does the new DMARC specification allow faster reporting? Yes. RFC 9990 describes aggregate feedback as daily or more frequent, so shorter intervals are permitted. The ri tag that once let domain owners request a shorter interval was removed in RFC 9989, so there is no longer a mechanism to ask receivers for faster reports. The instant report inbox works within the specification by acting as a receiver that chooses the "more frequent" option with a one minute reporting window.